What should you prioritize when documenting a security incident?

• A. Reasonable notes
• B. Personal opinions
• C. Speculation
• D. Deleting prior notes

Answer: (A)

Accurate, objective incident documentation is essential because it creates a trustworthy record of what happened, when it happened, who was involved, what evidence was collected, and how the response was handled. Focusing on reasonable notes means sticking to facts, timestamps, system identifiers, observed indicators, and the specific actions taken, along with any decisions made and the rationale behind them. This level of detail helps responders coordinate effectively, supports any later investigation or legal/compliance review, and allows for meaningful post-incident analysis and improvements to prevent recurrence.

Personal opinions and speculation should be avoided because they introduce bias and uncertainty, which can mislead readers and undermine the credibility of the incident record. Deleting or altering prior notes breaks the chain of custody and damages the integrity of the evidence, making it harder to reconstruct events accurately or defend findings later.